Bug 19125 - XSS - members.pl
Summary: XSS - members.pl
Status: CLOSED FIXED
Alias: None
Product: Koha
Classification: Unclassified
Component: Architecture, internals, and plumbing (show other bugs)
Version: unspecified
Hardware: All All
: P5 - low major (vote)
Assignee: Katrin Fischer
QA Contact: Marcel de Rooy
URL:
Keywords:
Depends on: 14568
Blocks:
  Show dependency treegraph
 
Reported: 2017-08-16 09:44 UTC by Katrin Fischer
Modified: 2019-10-14 19:58 UTC (History)
9 users (show)

See Also:
Change sponsored?: ---
Patch complexity: Small patch
Documentation contact:
Documentation submission:
Text to go in the release notes:
Version(s) released in:


Attachments
Bug 19125 - XSS - members.pl (6.46 KB, patch)
2017-08-16 10:10 UTC, Katrin Fischer
Details | Diff | Splinter Review
Bug 19125 - XSS - members.pl (6.52 KB, patch)
2017-08-19 09:01 UTC, Amit Gupta
Details | Diff | Splinter Review
Bug 19125 - XSS - members.pl (6.62 KB, patch)
2017-08-25 06:33 UTC, Marcel de Rooy
Details | Diff | Splinter Review

Note You need to log in before you can comment on or make changes to this bug.
Description Katrin Fischer 2017-08-16 09:44:03 UTC
Found some more while testing 19086.
Comment 1 Katrin Fischer 2017-08-16 10:05:23 UTC
Patch for this coming!
Comment 2 Katrin Fischer 2017-08-16 10:10:19 UTC
Created attachment 66057 [details] [review]
Bug 19125 - XSS - members.pl

In preparation to test this patch:
- Add a patron list named <script>alert("patron list")</script>
- Add a library named <script>alert("library")</script>
- Add a patron category named <script>alert("patron category")</script>

To test:
- Access patron search page and do a search
- Verify that the alerts added above are executed
- Apply patch
- Verify that no alerts are displayed
Comment 3 Amit Gupta 2017-08-19 09:01:44 UTC
Created attachment 66220 [details] [review]
Bug 19125 - XSS - members.pl

In preparation to test this patch:
- Add a patron list named <script>alert("patron list")</script>
- Add a library named <script>alert("library")</script>
- Add a patron category named <script>alert("patron category")</script>

To test:
- Access patron search page and do a search
- Verify that the alerts added above are executed
- Apply patch
- Verify that no alerts are displayed
Comment 4 Marcel de Rooy 2017-08-25 06:33:22 UTC
<option value="[% l.branchcode | html %]">[% l.branchname |html %]</option>

<option value="[% b.branchcode %]">[% b.branchname |html %]</option>

Why escape branchcode in the first only ?
Comment 5 Marcel de Rooy 2017-08-25 06:33:47 UTC
Created attachment 66449 [details] [review]
Bug 19125 - XSS - members.pl

In preparation to test this patch:
- Add a patron list named <script>alert("patron list")</script>
- Add a library named <script>alert("library")</script>
- Add a patron category named <script>alert("patron category")</script>

To test:
- Access patron search page and do a search
- Verify that the alerts added above are executed
- Apply patch
- Verify that no alerts are displayed

Signed-off-by: Amit Gupta <amit.gupta@informaticsglobal.com>

Signed-off-by: Marcel de Rooy <m.de.rooy@rijksmuseum.nl>
Comment 6 Katrin Fischer 2017-09-19 21:00:40 UTC
This patch has been pushed to 16.11.x and will be in 16.11.12.
Comment 7 Fridolin Somers 2017-09-22 15:05:44 UTC
These patches have been pushed to 17.05.x and are in 17.05.04.
Comment 8 Jonathan Druart 2017-09-29 15:47:38 UTC
Pushed to master for 17.11, thanks to everybody involved!
Comment 9 Mason James 2017-11-23 22:04:17 UTC
Pushed to 16.05.x, for 16.05.17 release